[ahrazzle]

Problem

main has branch protection (required review, enforce_admins). The prerender workflow regenerated docs/writing/index.html and pushed with GITHUB_TOKEN, which now fails with GH006. The live writing page still shows a stale progress bar (pv-done width 1.0684931506853%); with current data it should be about 1.70%.

Approach (owner decision)

Refresh data-rendered HTML at GitHub Pages publish time, never commit it to main.

Changes

.github/workflows/pages.yml

• Header comment: documents forum index and full prerender at deploy time.
• Prerender step: node scripts/prerender.mjs (all marked pages, including docs/writing/) instead of only docs/forum/index.html.
• Build job already runs on ubuntu-24.04 with Playwright 1.56.1 (avoids ubuntu-26.04 / chromium build gap).
• Existing triggers unchanged: push to main, discussions, daily cron 23 5 * * *, workflow_dispatch — so the writing progress bar advances on schedule without commits.

.github/workflows/prerender.yml

• Removed. No workflow pushes prerendered HTML to main.

.github/workflows/update.yml

• Unchanged behavior (still git push for generated kappa/feed data). Same GH006 class of failure under branch protection; fixing that needs a bypass token or PR-based updates — called out in a workflow comment, out of scope for the prerender-at-publish fix.

scripts/prerender.mjs

• Doc comment: CI baking is via pages.yml, not a commit workflow.

Proof (local, this branch)

PRERENDER_CHROMIUM=playwright node scripts/prerender.mjs docs/writing/index.html

Generated pv-done width: 1.698630136986595% (expected ~1.70%). Generated HTML was not committed.

Head SHA

22b6f89

  

[zero-aska]

Independent review at 22b6f89dd0453cd056a10de595f53de9fc722fef. Verdict: APPROVE. One non-blocking follow-up: README.md:67 and CONTRIBUTING.md:58 still describe the deleted prerender workflow (section 3).

The deploy bakes the writing page at publish time, fails closed, and stops the prerender workflow from pushing to main. I reproduced the Pages build steps. The new bar width is the 11 Nov 2026 value. The live page is still the 19 Oct 2026 bake.

1. Reproduction

Pages is published by Actions, custom domain fdn0.org (build_type: workflow, cname: fdn0.org, html_url: http://fdn0.org/). There is no CNAME file in the repo. https://foundation-0.github.io/f0/writing/ returns 301 to http://fdn0.org/writing/.

Live https://fdn0.org/writing/ (last-modified Wed, 11 Nov 2026 18:15:16 GMT, the deploy from run 43075874200):

pv-done" style="left:6.904109589040671%;width:1.0684931506853%"

That string is in the committed file, seven times (docs/writing/index.html). It was last written on 19 Oct 2026 (1c35482). Today's deploy ran the old step node scripts/prerender.mjs docs/forum/index.html, so it published that committed HTML.

docs/writing/page.js sets the width from UTC dates. F0.decYear (docs/assets/f0.js:83-88) is the day offset inside the year. The axis is 2026–2036. The essay date is 2026-09-10 (docs/writing/annotations.json). 2026 has 365 days.

• 10 Sep 2026 is day offset 252. Left edge: 6.904109589040671%.
• 19 Oct 2026 is 39 days later. Width: 1.0684931506853%. That is the live and committed value.
• 11 Nov 2026 is 62 days later. Width: 1.698630136986595%.

The prose "in 1 year 2 months" rounds to the same month count on both dates. The staleness is only the CSS width.

Same steps as pages.yml after the source check, on a copy of 22b6f89, Node v22.23.4 (the workflow asks for Node 22):

discussions: wrote docs/data/discussions.json (2 of 2 threads, 13 categories, enabled=True)
site gate: all checks pass
added 2 packages in 2s
Chromium Headless Shell 141.0.7390.37 (playwright build v1194) downloaded
updated       docs/writing/index.html (10 marked parts)
updated       docs/forum/index.html (5 marked parts)
prerender: 10 page(s), 2 updated
site gate: all checks pass

The artifact directory is docs/ (pages.yml:90-93). docs/writing/index.html then has width:1.698630136986595% on all seven rows, and pv-now at left:8.602739726027266%. That matches the author claim. The other eight marked pages were unchanged. The forum page changed because discussions.py had just rewritten the index, which is the existing deploy behavior.

2. pages.yml

Triggers are unchanged: push to main, discussion, discussion_comment, cron 23 5 * * *, workflow_dispatch (pages.yml:15-22). Concurrency group pages, cancel-in-progress: false (pages.yml:26-27). Build permissions stay contents: read, discussions: read, pages: read. Deploy stays pages: write and id-token: write. Checkout sets persist-credentials: false. There is no git command.

Node 22 and Playwright 1.56.1 on ubuntu-24.04 are unchanged (pages.yml:33, pages.yml:71-78). Chromium is installed every run (npx playwright install --with-deps chromium). It is not cached. The install in this run fetched Chromium 141.0.7390.37, build v1194, the same build #33's review recorded. Ten pages finished in about 17 seconds. The job timeout is 15 minutes.

The new step is node scripts/prerender.mjs with PRERENDER_CHROMIUM: playwright (pages.yml:80-84). The script writes into docs/**/*.html, which is the uploaded path. If any page fails it writes nothing and exits 1 (scripts/prerender.mjs:310-311). Later steps use if: steps.source.outputs.publish == 'true' and do not call success(), failure(), always(), or cancelled(). GitHub still applies the default success() check in that case, so a failed prerender skips the site gate and the upload. The deploy job needs: build and its if also omit a status function, so a failed build is not deployed. A failed prerender leaves the previous deploy up.

Scheduled Pages runs from 29 Oct through 11 Nov 12:49 failed on 189893ba, where pages.yml still said runs-on: ubuntu-latest. That commit is an ancestor of the Ubuntu 24.04 pin. Push deploys after the pin succeeded, including 43075874200. The cron has not run since the pin. The next one is 05:23 UTC.

3. Deleting prerender.yml

The deleted workflow ran on push to main for docs/data/**, docs/**/*.js, and itself, on pull requests for those paths, and on workflow_dispatch. It had no schedule and no workflow_run. Nothing else in .github/workflows references it. site.yml does not run the script.

update.yml commits docs/feed.json, docs/chart-data.json, docs/feed.schema.json, and files under data/. Those paths were outside the old path filter, so that push never rebaked pages. The writing bar does not read those files. It reads the clock, so it only moved when someone reran prerender. The last run that wrote the width was 19 Oct.

After this change, every successful Pages run bakes all ten marked pages. A push to main made with GITHUB_TOKEN does not start that run. GitHub's rule is that events from GITHUB_TOKEN do not create workflow runs, except workflow_dispatch and repository_dispatch, and a GITHUB_TOKEN push does not trigger a Pages build. update.yml checks out with the default token (actions/checkout@v4, credentials persisted) and git pushes at update.yml:49. That push will not start pages.yml. The writing bar still moves on the daily cron, on discussion events, on a human push, and on workflow_dispatch.

#34 (merged today, approved by zero-aska) had just made the same job run on pull requests and skip the commit there. Run 43075092178 passed and skipped "Commit changed pages". Deleting the file removes that pull-request run. site.yml does not replace it. A broken prerender now fails the next production deploy instead of the PR. The deploy still will not publish a half-rendered tree.

#35 has no reviews or threads. #33 and #34 have approvals and no review threads. #9's approval does not discuss this mechanism.

README.md:67 and CONTRIBUTING.md:58 still say the prerender workflow runs on main and commits the HTML. That will be false once this merges. The script header was updated. Those two sentences were not.

4. update.yml

The job still commits and pushes to main (update.yml:43-49) with contents: write. This PR adds only the comment at update.yml:12-13. The push behavior is the same, so the protection failure on that push is unchanged. The PR makes the overall GH006 exposure better by deleting the workflow that was still pushing HTML.

The push-event prerender run 43075874300 failed in 50s on the #34 merge. Its annotation is Process completed with exit code 1. The pull-request run of that same workflow passed. The log archive for the failed run is an empty 22-byte zip, and the jobs API returned 502, so the GH006 text is not in hand. The comment matches the step that exists only on the push run.

The update workflow's state is disabled_manually. Its last runs are workflow_dispatch successes on 11 Oct 2026. Scheduled runs are not currently reaching the push. If it is enabled again, the comment describes the script: commit on the runner, then git push.

5. scripts/prerender.mjs

The only edit is the header at scripts/prerender.mjs:4-8. Behavior is unchanged. Local runs still write docs/**/*.html. CI still selects Playwright's Chromium through PRERENDER_CHROMIUM=playwright (scripts/prerender.mjs:272-276), which is what pages.yml sets. The new sentence matches both.

6. Security

No new secrets, no new write permission, and no pull_request_target. The deleted workflow's contents: write goes away. pages.yml permissions are unchanged. update.yml still has contents: write. Discussion text still enters the job only through scripts/discussions.py, not through a shell expansion. Playwright stays 1.56.1, the version already on main.